AZ-104 Timed Practice Test 3 — 10 Questions

Question 1

A team moved blob data to the Archive tier to minimize cost. They now need to restore a few files for an audit. Which two statements are true about accessing archived blobs? Select two.

Accepted Answer

Rehydration is required before the blob can be read or copied.. Archived blobs are in an offline state and cannot be read or copied directly. They must first be rehydrated to an online tier (Hot or Cool) through a process that changes the blob's tier or copies it to a new online blob. This rehydration process is asynchronous and takes time, depending on the priority set.

Answer

Archived blobs can be read immediately through normal blob reads.

Answer

Archive tier provides the fastest retrieval time.

Answer

Changing a blob from Archive to Hot completes instantly and synchronously.

Question 2

Your organization wants all subscriptions under the Corp-MG management group to inherit a policy that blocks deployment of resource types not on an approved list. Which Azure feature should you use?

Accepted Answer

Azure Policy assigned at the management group scope. Azure Policy assigned at the management group scope is the correct choice because it allows you to enforce governance rules across all subscriptions within a management group hierarchy. By creating a policy definition that blocks deployment of resource types not on an approved list and assigning it to the Corp-MG management group, the policy will be inherited by all child subscriptions, ensuring consistent compliance without manual configuration per subscription.

Answer

A custom RBAC role assigned at the tenant root

Answer

A ReadOnly lock on each subscription

Answer

A budget alert for each subscription

Question 3

A team wants every resource in a subscription to include a Department tag. New resources that do not have the tag should be blocked from being created. Which Azure Policy effect should you use?

Accepted Answer

Deny. The Deny effect is correct because it actively blocks any resource creation or update request that does not include the required Department tag, enforcing compliance at the time of the operation. Unlike Audit, which only logs non-compliant resources, Deny prevents the non-compliant resource from being provisioned, directly meeting the requirement to block new resources without the tag.

Answer

Audit

Answer

Append

Answer

Disabled

Question 4

A three-tier application uses separate web and app VMs that are scaled in and out regularly. The administrator must allow only the web tier to connect to the app tier on TCP 8080 without continually updating IP addresses. What should be configured in the NSG rule?

Accepted Answer

Use application security groups for the web and app tiers and reference those groups in the NSG rule.. Application security groups (ASGs) allow you to group VMs logically by their application role (e.g., web tier, app tier) and reference those groups directly in NSG rules. This eliminates the need to maintain individual IP addresses or CIDR ranges when VMs scale in or out, because the NSG rule dynamically applies to all VMs in the ASG. By creating an inbound NSG rule that allows TCP 8080 from the web-tier ASG to the app-tier ASG, the administrator achieves the required connectivity without manual IP updates.

Answer

Add a subnet-to-subnet peering connection between the web and app subnets.

Answer

Create a load balancer backend pool rule for TCP 8080.

Answer

Use a user-defined route that sends TCP 8080 traffic to the app tier.

Question 5

A VM cannot connect to another VM on TCP 1433. You need to determine whether an NSG is blocking the flow and identify which rule applies. Which Network Watcher tool should you use?

Accepted Answer

IP flow verify. IP flow verify is the correct Network Watcher tool because it tests whether a packet is allowed or denied to or from a specific VM, based on a 5-tuple (source IP, destination IP, protocol, source port, destination port). For TCP 1433 (SQL Server), you can specify the exact flow parameters, and IP flow verify will evaluate all effective security rules, including NSG rules, and return the specific rule that allowed or denied the traffic.

Answer

Packet capture

Answer

Connection troubleshoot

Answer

Effective routes

Question 6

An Azure virtual machine was moved to a host that is experiencing intermittent issues. You need to move the VM to a different Azure host while keeping the existing managed disks and configuration. Which action should you perform?

Accepted Answer

Redeploy. Redeploying the VM (Option C) is the correct action because it moves the VM to a new Azure host node while preserving the existing managed disks, virtual network, and configuration. The Azure platform automatically selects a healthy host, resolves transient hardware issues, and maintains the VM's identity and associated resources.

Answer

Stop

Answer

Restart

Answer

Capture

Question 7

You need to view recommendations about underutilized virtual machines, security improvements, and cost-saving opportunities in Azure. Which service should you use?

Accepted Answer

Azure Advisor. Azure Advisor provides personalized best-practice recommendations related to reliability, security, performance, operational excellence, and cost.

Answer

Azure Policy

Answer

Network Watcher

Answer

Azure Backup

Question 8

The platform team wants to block deployment of Azure resources in any region except East US and West US. What should they configure?

Accepted Answer

An Azure Policy assignment that uses an allowed locations policy. Azure Policy's 'allowed locations' built-in policy definition enables you to restrict the regions where resources can be deployed. By assigning this policy at a management group or subscription scope with a parameter list containing only 'East US' and 'West US', any attempt to deploy resources in other regions will be denied at the Azure Resource Manager level, effectively blocking non-compliant deployments.

Answer

A Reader role assignment at the management group

Answer

A CanNotDelete lock on the subscription

Answer

A tag requirement enforced only by resource group naming

Question 9

A user accidentally deleted a file from an Azure VM. The administrator wants to recover only the deleted file from the most recent backup instead of restoring the entire VM. What should the administrator use?

Accepted Answer

File recovery from the Azure Backup restore process. Azure Backup's file-level recovery (also known as item-level restore) allows you to recover individual files or folders from a VM backup point without restoring the entire VM. This is achieved by mounting the recovery point as a drive on the same or another VM, enabling direct file copy. Option A is correct because this feature is specifically designed for granular recovery of deleted files from the most recent backup.

Answer

A new VM image

Answer

A metric alert

Answer

An NSG flow log

Question 10

A user deleted several files from an Azure VM, and the administrator wants to use Azure Backup file recovery. Which two items are needed to start the recovery process? Select two.

Accepted Answer

A recovery point. Azure Backup file recovery requires a recovery point (A) because it represents the snapshot of the VM's data at a specific time from which files can be restored. The file recovery script (C) is downloaded from the Recovery Services vault and mounts the recovery point as a drive on the VM, enabling file-level access. Without both, the recovery process cannot proceed.

Answer

An application security group

Answer

A metric alert rule

Answer

A user-assigned managed identity